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SYSTEMS AND METHODS FOR MAKING ELECTRONIC FILES THAT HAVE BEEN 
CONVERTED TO A SAFE FORMAT AVAILABLE FOR VIEWING BY AN INTENDED 

recipient 
Background 

Field of the Invention 

[0001] The present invention relates generally to the handling of electronic files infected with a 
computer virus and, more particularly, to systems and methods for converting infected electronic 
files to a safe format. 

Discussion of the Related Art 

[0002] Computer viruses present a significant threat to the integrity and reliability of computer 
systems, especially as more computers on different networks communicate with one another via 
electronic mail and other electronic communication avenues. Anti-virus software has thus 
become an important part in the effective maintenance of computer systems. 

[0003] Many conventional anti-virus programs scan incoming electronic mail for viruses, which 
are often embedded in an attachment to electronic mail. If the anti-virus software detects a virus 
in the attachment of the electronic mail, the software will attempt to disinfect or clean the file by 
removing the virus. To ensure that the intended recipient of the electronic mail can open and 
view the cleansed file, anti- virus programs retain the format of the infected file such that the file 
is still associated with and may be opened with the same application. For example, if the 
infected attachment is a Microsoft Word format file having a macro-virus amongst safe macros, 
the cleansed file is still a Microsoft Word format file having the safe macros. 
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[0004] To ensure comprehensive virus protection, users of many anti- virus software packages are 
encouraged to periodically receive updates of new virus remedies that permit the software to 
identify and disinfect files infected with new viruses. If a user does not have an update for a new 
virus or an update does not yet exist for the new virus, the anti-virus software may not detect the 
virus such that it problematically passes through the anti-virus software and infects the recipient's 
computer and possibly other users on the recipient's system or network. This is one of the more 
persistent problems associated with conventional anti-virus software packages. To combat this 
problem, some anti-virus programs attempt to detect potential new viruses with a heuristic scan, 
which is essentially a search for files that behave like viruses. While heuristic scans may identify 
potential viruses, they often produce false alarms when a clean file behaves as a virus might. If a 
heuristic scan identifies a new virus, it is most likely that the anti-virus software cannot disinfect 
the file. In this instance, the anti-virus software typically quarantines or deletes the infected 
attachment and forwards the e-mail message to the intended recipient. The recipient can read the 
e-mail message but not the infected attachment, which is typically replaced with a notice advising 
the recipient that the original attachment was infected. Hence, the recipient cannot view the 
attachment, which often frustrates the recipient ~ especially in instances where the infected 
attachment is necessary to complete an urgent task. Despite the risks associated with opening 
infected files, many recipients would rather risk opening infected files than forego the 
opportunity to view the contents of the files. 

Summary of the Invention 

[0005] In light of the foregoing problems, embodiments of the present invention strive to provide 
a system and method that prevents new computer viruses associated with an electronic file from 
infecting the computer of an intended recipient of the electronic file, even for those viruses for 
which virus remedies are not available. Additionally, embodiments of the present invention 
strive to provide a system and method by which an intended recipient can view the contents of an 
infected electronic file without infecting the computer of the intended recipient. 
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[0006] Other advantages and features associated with the present invention will become more 
readily apparent to those skilled in the art from the following detailed description. As will be 
realized, the invention is capable of other and different embodiments, and its several details are 
capable of modification in various obvious aspects, all without departing from the invention. 
Accordingly, the drawings and the description are to be regarded as illustrative in nature, and not 
limitative. 

Brief Description of the Drawings 

[0007] Figure 1 is a schematic of a network in accordance with one embodiment of the present 
invention. 

[0008] Figure 2 is a flow diagram illustrating one embodiment of a method of the present 
invention. 

Detailed Description of the Preferred Embodiments 

[0009] The entire disclosure of U.S. Utility Application entitled "Systems and Methods for 
Converting Infected Electronic Files to a Safe Format, " filed on the same day as the present 
application, and bearing Attorney Docket No. NTWK017/00US is here by incorporated by 
reference. Figure 1 illustrates a network 100 that may be operated in accordance with one 
embodiment of the present invention, and Figure 2 illustrates a flow chart of an exemplary 
method of the present invention. As illustrated in Figure 1, the network 100 includes a first 
network 1 1 8a connected to a second network 118b, and a plurality of computers 1 10a, 1 10b, 
1 10c, 1 lOd that send and receive electronic files to and from each other. The computers 1 10a 
and 1 1 0b reside on the first network 1 1 8a, while the computers 1 1 0c and 1 1 Od reside on the 
second network 1 1 8b. The first network 1 1 8a enables communication amongst the computers 
1 10a, 1 10b and a server computer 122a, and the second network 1 18b enables communication 
amongst the computers 1 10c, 1 lOd, a server computer 122b, and a gateway computer 120. The 
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networks 1 18a, 1 18b include any wired or wireless transmission channels having any number of 
servers, computers, routers, switches, bridges, etc, and may also include one or more 
interconnecting networks. 

[0010] The computers 1 10a, 1 10b, 1 10c, 1 lOd are devices such as desktop computers, laptop 
computers, workstations, telephones, wireless phones, personal digital assistants ("PDA's"), 
servers, pagers, and other wireless or hardwired electronic communication devices. The 
computers 1 10a, 1 10b, 1 10c, 1 lOd each include a central processing unit ("CPU") 1 12a, 1 12b, 
1 12c, 1 1 2d connected to a memory (primary and/or secondary) 1 14a, 1 14b, 1 14c, 1 14d that 
stores one or more computer programs for carrying out the operations described below, such as 
the communication of electronic files between the respective computers 1 1 0a, 1 1 0b, 1 1 0c, 1 1 Od. 
As is known, the computer programs of the computers 1 10a, 1 10b, 1 10c, 1 lOd are used to 
communicate with server computers 122a, 122b and to visually present the information received 
from such computers. The computers 1 10a, 1 10b, 1 10c, 1 lOd each establish network 
communication through a standard network connection device 1 16a, 1 16b, 1 16c, 1 16d, such as a 
wired or wireless network connection card. 

[0011] As is illustrated in Figure 1 , the gateway 120 separates the second network 1 1 8b from the 
first network 1 1 8a. The gateway 120 is a computer that selectively accepts and blocks 
information that is transmitted to and from the second network 1 1 8b. As will be appreciated, 
the gateway 120 can include various forms of firewall-type functionality. 

[0012] The server computers 122a, 122b each include standard server computer components, 
including a network connection device 124a, 124b, a CPU 126a, 126b, and a memory structure 
128a, 128b. The memories 128a, 128b each store one or more computer programs that 
implement standard communication between the computers 110a, 110b, 110c, 11 Od of the 
network 100. The server computer 122b of the second network 1 18b is connected to the 
computers 1 10c, 1 lOd and executes programs for carrying out various functions, including e-mail 
communication between the computer 1 10c and the computer 1 lOd within the second network 
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1 18b, as well as e-mail communication between the computers 1 10c ? 1 lOd and the computers 
1 10a, 1 10b of the first network 1 18a. In the illustrated embodiment, the memory 126b of the 
server computer 122b stores one or more programs to implement processing associated with one 
embodiment of the present invention. The operation of one embodiment of the invention is now 
described with reference to Figure 2. 

[0013] Figure 2 illustrates a flowchart of one embodiment of a method in accordance with the 
present invention. When a user ("sender") of the computer 1 10a ("sender computer") desires to 
send an electronic file to a user ("intended recipient") of the computer 1 lOd ("recipient 
computer"), the sender, at a step 200, sends the electronic file to the intended recipient via 
standard electronic communication vehicles such as e-mail. For example, the sender may create 
an e-mail message with software resident on the sender computer 1 10a or the server computer 
122a and then attach the electronic file to the e-mail message. The sender addresses the e-mail 
message to the address of the recipient computer 1 lOd and at step 200, sends, i.e. forwards, the e- 
mail message and the attached electronic file to the recipient computer 1 lOd over the network 
100. For purposes of illustration, the electronic file sent by the sender is infected with a 
computer virus. 

[0014] A computer virus is a sequence of commands or instructions that interfere with a user's 
operation of, or cause damage to, a computer system, such as the user f s computer 1 lOd, the server 
computer 122b, or other computers on the user's network 1 1 8b. Computer viruses may damage a 
computer system directly, such as by deleting files or formatting a disk, or indirectly, such as by 
altering the computer system's protective measures and thus making the computer system 
vulnerable to probing or other attacks. Most computer viruses are computer program files that 
are capable of attaching to electronic files and causing damage to the file itself, other files, 
programs of the computer system on which the infected file is located, or programs and files of 
computers that communicate with the infected computer system. Some viruses replicate, some 
sit in a computer's memory and infect files as the computer opens, modifies or creates files. 
Some viruses damage files and computer systems without the user noticing the damage. While 

5 



Attorney Docket No: NTWK015/OOUS (01.049.01) 

virus creators once focused on binary executable computer files, such as those with a ".EXE" or a 
".COM" file extension, they now target other types of files, such as batch files and script files 
that contain instructions that are executed in conjunction with binary executable programs. For 
example, computer viruses are often found in the macros, i.e. scripts, of Microsoft Word files, in 
Windows Batch files (.BAT), and in Visual Basic Script files (. VSB), which are all typically text 
files having instructions or commands that are executed by a computer without user interaction. 

[0015] As will be appreciated, an infected electronic file sent by a sender may be any file format 
that is capable of carrying a computer virus. Electronic files that are capable of carrying an 
executable virus include word processing files, spreadsheet files, database files, graphics files, 
presentation files, compressed or encoded files, and binary executable files. For example, a virus 
may be carried by an electronic file having one of the following word processing file format 
types: ANSI; ASCII; Corel WordPerfect; DEC WPS Plus; DisplayWrite; Enable; First Choice; 
1MB FFT; Legacy; Lotus WordPro; RTF (with scripts); Microsoft Word; Novell; Office Writer; 
WordStar; etc. A virus may also be carried by an electronic file having one of the following 
spreadsheet file format types: Enable; First Choice; Lotus 1-2-3; Microsoft Excel; Microsoft 
Multiplan, Microsoft Works; QuattroPro; SmartWare; etc. A virus may be carried by an 
electronic file having one of the following database file format types: Access; dBase; DBXL; 
Enable; FoxBase; Framework; Microsoft Works; Paradox; R:Base; Reflex; Smartware; etc. A 
virus may be carried by an electronic file having one of the following graphics file format types: 
AI; CDR; DCR; DSF; DWG; CGM; CMX; DCX; DRW; DXF; EMF; EPS; FMV; FPX; GDF; 
GEM;; GP4; HPGL; IGES; IMG; JFIF; MET; PBM; PCD; PCX Bitmap; PDF; Perfect Works; 
PGM; PIC; PIF; PNG; PNTG; PPM; PS; PSD; PSP; RND; SDW; Snapshot; SRS; Targa; TIFF; 
VISO; WMF; WPG; XBM; XPM; XWD, etc. A virus may be earned by an electronic file 
having one of the following presentation file format types: Corell; Novell; Harvard Graphics; 
Freelance; PowerPoint; etc. A virus may be carried by an electronic file having one of the 
following compressed or encoded file format types: ARJ; ARC; BZIP; GZIP; LZA; LZH; 
Microsoft Binder; MIME; Neolite; UUEncode; UNIX Compress; UNIX TAR; ZIP; etc. A virus 
may also be carried by an electronic file having one of the following other formats: EXE; DLL; 
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MSG; VSB; SVR; BAT; COM; SYS; DRV; BIN; OVL; OVY; etc. 

[0016] In the illustrated embodiment, the e-mail message originates at sender computer 1 10a on 
first network 1 18a. The e-mail message is processed by one or more mail servers and forwarded 
to second network 1 1 8b. Prior to entering second network 1 1 8b, the e-mail message is processed 
by the gateway computer 120. If the gateway computer 120 permits the e-mail message to enter 
into the second network 1 18b, the e-mail message is then forwarded to the server computer 122b, 
which functions as an internal mail server. At a step 202, the server computer 122b receives the 
e-mail message and the electronic file. 

[0017J In accordance with one embodiment of the present invention, after the server computer 
122b has received the e-mail message and attached electronic file, the server computer 122b then 
accesses a program stored in the memory 128b or another location, which, when executed by the 
server computer at a step 204, converts the received electronic file to a safe file format. The safe 
file format is a file format that is different from the file format of the infected electronic file 
received by the server computer 122b and that prevents the virus of the received electronic file 
from executing when, at steps 206 and 208, the converted electronic file is made available for 
viewing by the intended recipient and eventually opened by the recipient computer 1 1 Od. The 
safe file format type prevents the computer virus from executing when the converted electronic 
file is opened by the intended recipient because the conversion to the safe file format either 
removes the computer virus from the electronic file or renders the virus inoperable. This ensures 
that the computer virus is unable to harm the intended recipient's computer or other items of the 
network 100 when the converted electronic file is opened by the intended recipient. 

[0018] Safe file formats that prevent the virus of the infected electronic file from executing 
include pure text file formats that do not include scripts, as well as other file formats that render 
the virus inoperable or removes viruses during the converting process. For example, in one 
embodiment, received electronic files that are in a word processing file format are converted to a 
pure text format that does not include scripts, such as a TXT file format, a RTF file format 
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(without embedded objects), or a HTML file format (without scripts). Any computer viruses are 
either removed or rendered inoperable when the converted electronic file is ultimately opened 
with a word processing application of the recipient computer 1 lOd. In other examples, received 
electronic files that are in a spreadsheet file format are converted to a HTML file format or a 
CSV file format. Received electronic files that are in a database file format are converted to a 
HTML file format. Received electronic files that are in a graphics file format are converted to a 
JPB, a BMP, a JPEG, a HTML, or a GIF file format, and received electronic files that are in a 
presentation file format are converted to a JPB, a GIF, a BMP, a JPEG, or a HTML file format. 
Other file formats that prevent viruses from executing include ASCII file formats. As will be 
appreciated, the above and other file formats are considered to be safe format file types because 
these file format types prevent computer virus from executing when the converted electronic file 
is opened by the intended recipient because the computer virus is either removed or rendered 
inoperable. 

[0019] Considering a specific example, if the electronic file received by the server computer 
122b is a Microsoft Word, Excel, or Access format file, the electronic file may include macros. 
Macros are script instructions designed to simplify repetitive tasks within a program, such as 
Microsoft Word, Excel, or Access, and are executed by a program when the user opens the 
associated electronic file. Unfortunately, macro viruses maybe written in the macro 
programming language and attached to the electronic file. When an electronic file containing a 
macro virus is opened in the target application in the conventional manner, the virus is executed, 
typically does damage and often copies itself into other files. In accordance with one 
embodiment of the present invention, the server computer 122b will convert a received Word 
format file having a macro virus therein into a pure text file format that does not include macros, 
such as a HTML file format (without scripts), a RTF file format (without embedded objects), or a 
TXT file format prior to the recipient computer 1 lOd receiving the electronic file. In this 
example of the conversion process, the received electronic file is read into the memory 128b, and 
any formatting characteristics in the received electronic file are then removed. The converted 
file is defined by then writing out the file in the memory and replacing it with the file from which 
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the formatting characteristics have been removed. As will be appreciated, this conversion 
process could execute for the entire file in the memory or successive portions of the file. In 
addition, the removed formatting could be replaced with appropriate new formatting to retain the 
original appearance of the infected file. 

[0020] A number of commercially available software products include computer executable code 
suitable for converting received electronic files into one of the aforementioned safe formats. For 
example, the computer executable software code that converts the received electronic file in 
accordance with the present invention may be similar to the code resident in and executed by 
many commercially available word processing programs, spreadsheet programs, graphic 
programs, and presentation programs when a user converts a file from one format to another 
format in response to a "SAVE AS" command. More particularly, exemplary code would include 
that associated with saving a file having a .DOC extension to a .TXT extension, or the code 
associated with saving a file having a . VS extension to a .BMP extension. Additionally, the 
computer executable software code that converts the infected electronic file in accordance with 
the present invention may be similar to the code executed by many commercially available 
viewer programs, such as Quick View Plus (commercially available through IntraNet Solutions, 
Inc., Eden Prairie, MN, USA), which permits users to view different format files with one 
application. 

[0021] After the electronic file has been converted to the safe format, the server computer 122b, 
at step 206, makes the converted electronic file available for viewing by the intended recipient, 
after which, at step 208, the recipient opens and views the converted electronic file with one or 
more applications resident on the computer 1 lOd or the server computer 122b. Because the 
electronic file has been converted to the aforementioned safe format, a virus associated with the 
electronic file is prevented from executing and infecting the computer system of the intended 
recipient. Hence, the intended recipient can view the contents of the electronic file without 
executing the virus. Additionally, because the conversion process prevents the virus from 
infecting the recipient computer 1 lOd, the second network 1 1 8b need not include a virus remedy 
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to detect and clean the virus from the received electronic file. 

[0022] In accordance with embodiments of the present invention, the converted electronic file 
may be made available for viewing by the intended recipient in a variety of manners. For 
example, in accordance with one embodiment, the converted electronic file is forwarded to the 
recipient computer 1 lOd via a the original e-mail message to the intended recipient. That is, the 
electronic file received by the service computer 122b is replaced with the converted electronic 
file and then sent to the recipient computer 1 lOd, where at step 208 the intended recipient may 
view the converted electronic file by opening the converted electronic file with an appropriate 
application. 

[0023] In accordance with another embodiment, the server computer 122b makes the converted 
electronic file available for viewing by the intended recipient by first determining whether the 
received electronic file represents a potential security risk in one of the manners described below. 
If it is determined that the received electronic file represents a potential security risk, then a 
notification is sent to the intended recipient, where the notification indicates that the electronic 
file represents a potential security risk. If the intended recipient desires to view the content of the 
received electronic file, the intended recipient forwards a request to the server computer 122b 
indicating that the intended recipient desires to view the contents of the electronic file. In 
response to this request, the server computer 122b forwards the converted electronic file to the 
recipient computer 1 lOd, where the intended recipient can open and view the converted 
electronic file. As is apparent, in this embodiment, the server computer 122b may convert the 
received electronic file before receiving the request from the intended recipient or in response to 
receiving the request. The server computer 122b may also convert the electronic file before 
determining whether the received electronic file represents a potential security risk or in response 
to a determination that the received electronic file represents a potential security risk. 

[0024] In another embodiment, the converted electronic file is made available for viewing by the 
intended recipient by storing the converted electronic file at a location on the memory 128b, the 
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memory 1 14d, or another memory, where the memory location is accessible by the intended 
recipient. As will be appreciated, the memory location may be a specific file, a directory, or a 
database on one or more storage mediums, such as a hard drive. For example, the converted 
electronic file may be stored in memory of the server 122b that is shared by the computers 1 10c, 
1 lOd. In another example, the converted electronic file may be stored in a memory of the server 
122b that is only allocated for the recipient computer 1 lOd. Alternatively, the server computer 
122b may store the converted electronic file in the memory of the recipient computer llOd. 
Furthermore, the converted electronic file may be stored in a quarantine store (a memory location 
allocated for electronic files that contain or might contain a virus) in which only an administrator 
has unlimited access and in which the intended recipient only has access to converted electronic 
files originally addressed to the intended recipient. In each of these examples, the intended 
recipient may access the memory location where the converted electronic file is stored such that 
the intended recipient can retrieve and open the converted electronic file from the memory. In 
accordance with one embodiment, the server computer 122b forwards an e-mail message to the 
intended recipient that identifies the memory location where the converted electronic file is 
located. For example, the server computer 122b may forward an email message identifying a 
shared memory location on the memory 128b of the server. Alternatively, the server computer 
may forward an e-mail message to the intended recipient that includes a uniform resource locator 
("URL") that identifies the memory location where the converted electronic file is located, such 
as the address of a web page containing the converted electronic file. To open and view the 
converted electronic file, the intended recipient accesses the web page via a web browser 
application. The server computer 122b may convert the electronic file before the intended 
recipient clicks the URL, or in response to the user clicking the URL. 

[0025] In a typical application of the invention, the server computer 122b will receive multiple 
electronic mails addressed to different recipient computers on the network 1 18b and each having 
an attached electronic file that may contain a virus. In accordance with one embodiment of the 
method illustrated in Figure 2, the server computer 122b will convert each received electronic 
file to one or more of the aforementioned safe formats regardless of the content of each electronic 
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file. That is, the computer executable code is configured such that every incoming message is 
converted to the safe format even though the incoming electronic file may or may not be infected 
with a computer virus. In this manner every received electronic file is converted to a safe format 
and forwarded by the server computer 122b to the appropriate recipient computer such that the 
recipient can safely view the electronic file. Hence, in this embodiment, the network 1 18b need 
not include or need not implement specific features of virus protection software that is capable of 
detecting and cleaning one or more specific viruses. In this and other embodiments of the 
present invention, the server computer 122b may include code configured to recognize or detect 
different received file format types, and to then choose one or more appropriate safe file formats 
that the received files will be converted to. For example, if the server computer 122b receives a 
first file having a word processing file format type and a second file having a graphics file format 
type, the server computer 122b will determine that the first file having the word processing file 
format will be converted to a TXT file format, a RTF file format (without scripts), or a HTML 
file format and that the second file having the graphics file format will be converted to a JPB file 
format, a BMP file format, a JPEG file format, a GIF file format, or a HTML file format. In an 
alternative embodiment, the code is configured such that the server computer 122b only converts 
those received electronic files having one or more particular file formats, such as the above- 
identified file format types that may support a potential computer virus. For example, the server 
computer 122b may examine the retrieved electronic files and only convert those electronic files 
that do not have the following safe format types: TXT file format; RTF file format (without 
embedded objects); BMP file format; JPEG file format; CSV file format; JPB file format; GIF 
file format; HTML file format (without scripts); and ASCII file format. In accordance with the 
above embodiments, the code recognizes the file format type of the received electronic files by 
examining the file extension of the electronic files or by other techniques. In a further 
embodiment, the code is configured such that the server computer 122b converts every received 
electronic file, regardless of format, to one safe format, such as a HTML file format. Hence, the 
server computer 122b need not examine the file format type of the received electronic files. 
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[0026] In a further embodiment of the method illustrated in Figure 2, the computer executable 
software code executed by the server computer 122b is configured to, after step 202 and before 
step 204, determine whether the received electronic file represents a potential risk to a computer 
system, such as the recipient computer 1 lOd, other computers on the network 1 18b, the server 
122b, or other components of the network 1 18b. For example, the server computer 122b may 
determine whether an electronic file represents a potential security risk to security by attempting 
to detect computer viruses in received electronic files. Hence, in this embodiment the memory 
128b of the server computer 122b contains a virus detection program and virus signature files. 
Virus signatures are sequences of computer readable characters that portray viruses found within 
textual and/or executable computer files in that they match the behavior exhibited by, or a series 
of characters found within, known viruses. The virus detection program includes computer- 
readable instructions which, when executed by the CPU 126b, search for viruses within received 
electronic files. Viruses in these received electronic files are identified by the detection of 
characteristics that match one of the virus signatures stored in the memory 128b. The virus 
detection program operates by opening the received electronic file and searching for at least one 
virus signature. VirusScan and GroupShield Exchange, both produced by Network Associates, 
Inc., are two efficacious programs for searching electronic files for virus signatures. As is 
known, the primary routine used by these anti-virus applications is "SCAN.EXE". hi general, the 
program SCAN.EXE operates by comparing the contents of a received electronic file with at 
least one known virus signature to determine if there is a match. In accordance with one 
embodiment of the present invention, the server computer 122b will first scan an incoming 
electronic file, such as one attached to an e-mail message addressed to the recipient computer 
1 lOd, for viruses before converting the electronic file to the aforementioned safe format. If it is 
determined that the incoming electronic file does not contain a computer virus, the server 
computer 122b will forward the e- mail message and the attached electronic file to the recipient 
computer 1 lOd. However, if the server computer 122b determines that the electronic file 
contains a computer virus, the infected electronic file is stored in a quarantine store, eventually 
converted at step 204 to the safe format, and at step 206 the converted electronic file is then made 
available for viewing by the intended recipient in one or more of the aforementioned manners. 
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[0027] In another embodiment, if the server computer 1 22b detects a virus in the received 
electronic file, the server computer will attempt to disinfect or clean the file in the conventional 
manner by removing the virus. However, if the server computer 122b cannot disinfect the 
infected electronic file, the server computer will then convert the infected electronic file to the 
safe format and then make the converted electronic file available for viewing by the intended 
recipient. 

[0028] In an additional embodiment, the server computer 122b determines whether the received 
electronic file represents a potential security risk by detecting potential viruses with a 
conventional heuristic scan in which the server computer 122b determines whether the contents 
of the electronic file reflect or behave like a potential computer virus. 

[0029] In a further embodiment, the server computer 122b determines whether an electronic file 
represents a potential security risk by determining whether the electronic file has a file extension 
indicative of a file type that supports a potential computer virus, such as those identified above. 

[0030] In one embodiment of the invention, the methodology illustrated in Figure 2 and 
alternative methodology described above is incorporated into a conventional virus detection 
program, such as Virus Scan and Group Shield Exchange, via which an administrator of the 
program can set settings that trigger the conversion of electronic files to the safe format in 
response to any of the criteria set forth or other criteria as will be apparent. 

[0031] The computer executable program code that receives an electronic file intended for 
delivery from the sender to the intended recipient and that converts the infected electronic file to 
the safe format may be stored and executed at other locations on the network 100. For example, 
in accordance with one embodiment of the invention, the computer executable code is located on 
the memory 1 14d of the recipient computer 1 lOd. In this embodiment, the recipient computer 
1 lOd will execute the program code such that the electronic file received by the recipient 
computer is converted to the safe format before the user opens the electronic file and causes 
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possible damage to the recipient computer 1 lOd. In a further embodiment of the present 
invention, the computer executable code may be located on a memory of the gateway computer 
120. In this embodiment, the gateway computer 120 will execute the program code such that the 
electronic file received by the gateway computer is converted to the safe format before the 
intended recipient has the opportunity to open the infected electronic file. As will also be 
appreciated, the computer executable program code may be stored and executed at any number of 
different and multiple locations on the network 100, such as the server 122a. Portions of or the 
entirety of the computer executable program code may also be distributed through a computer 
data signal embodied in a transmission medium of the network 100. 

[0032] Although the foregoing embodiments of the invention have been described in reference to 
an infected electronic file attached to an e-mail message, it will be appreciated that the invention 
is applicable to other types of infected electronic files that are intended for delivery from a sender 
to a recipient. For example, in one embodiment of the invention, electronic files received by 
HTTP, FTP, or another file transfer protocol are converted to a safe file format before the file is 
made available for viewing by the intended recipient. In a further example, the network 100 is 
internet based and communications thereon occur in accordance with web-browser and web page 
data that is transmitted by a server on the network 100. Users of the computers 1 10a, 1 10b, 
1 10c, 1 lOd communicate with each other on the network 100 via an Internet "chat room". 
Within a chat room, a user at one computer types messages that are received and displayed on the 
screen of the other users in the same chat room. Users can come and go from connections, 
establish periodic communication, etc. Such chat rooms are typically implemented by Internet 
relay chat programs, such as mIRC, which when executed automatically invoke a number of 
script files to perform various functions. Unfortunately, a computer virus, such as the mIRC 
virus, may be in the scripts of the chat room messages. La accordance with one embodiment of 
the invention, computer executable code on a user computer, on a server, or at another location 
will receive messages to be displayed on the chat room board and convert each message to a safe 
file format such as HTML (without scripts) before displaying the message to the recipients into 
the chat room. Because the messages are converted to the safe format, any script viruses are 
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prevented from infecting the recipient of the chat room message. 

[0033] In accordance with past technology, if a virus was detected in a received electronic file 
and the file could not be cleansed, the intended recipient could not view the contents of the file 
without attempting to open the infected files. Hence, many recipients would take the risk of 
opening infected files in instances where the infected files were necessary to complete an urgent 
task. Because the embodiments of the present invention convert infected electronic files to a safe 
format, computer viruses are advantageously prevented from executing such that the intended 
recipient can safely view the contents of infected electronic files, regardless of whether or not a 
virus remedy is available to disinfect the infected files or whether or not the virus was detected 
with a heuristic scan. 

[0034] The principles, preferred embodiments, and modes of operation of the present invention 
have been described in the foregoing description. However, the invention that is intended to be 
protected is not to be construed as limited to the particular embodiments disclosed. Further, the 
embodiments described herein are to be regarded as illustrative rather than restrictive. Others 
may make variations and changes, and equivalents employed, without departing from the spirit of 
the present invention. Accordingly, it is expressly intended that all such variations, changes and 
equivalents which fall within the spirit and scope of the present invention as defined in the 
claims be embraced thereby. 
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